thread stuck when destroy mmap_disk_job

[Lwxiang]

Please provide the following information

libtorrent version (or branch): 2.0.8 boost version: 1.67.0

platform/architecture: centos7/x86_64

compiler and compiler version: gcc7.3.1

thread stuck in boost find_prev

#0  0x0000000000f01302 in boost::simple_segregated_storage<unsigned long>::find_prev(void*) ()
#1  0x0000000000f0117c in boost::simple_segregated_storage<unsigned long>::ordered_free(void*) ()
#2  0x0000000000f00d94 in boost::pool<libtorrent::aux::allocator_new_delete>::ordered_free(void*) ()
#3  0x0000000000f00d08 in boost::object_pool<libtorrent::aux::mmap_disk_job, libtorrent::aux::allocator_new_delete>::free(libtorrent::aux::mmap_disk_job*) ()
#4  0x0000000000f00c8d in boost::object_pool<libtorrent::aux::mmap_disk_job, libtorrent::aux::allocator_new_delete>::destroy(libtorrent::aux::mmap_disk_job*) ()
#5  0x0000000000f00999 in libtorrent::aux::disk_job_pool::free_jobs(libtorrent::aux::mmap_disk_job**, int) ()
#6  0x0000000000dbab79 in libtorrent::mmap_disk_io::call_job_handlers() ()
#7  0x0000000000dba60b in libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}::operator()() const ()
#8  0x0000000000dbc0f0 in void boost::asio::asio_handler_invoke<libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}>(libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorr
ent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}&, ...) ()
#9  0x0000000000dbbfe6 in void boost_asio_handler_invoke_helpers::invoke<libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}, {lambda()#1}>(libtorrent::mmap_disk_io::add_completed_jobs_impl(libtor
rent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}&, {lambda()#1}&) ()
#10 0x0000000000dbbf7a in void boost::asio::system_executor::dispatch<libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}, std::allocator<void> >(libtorrent::mmap_disk_io::add_completed_jobs_impl(
libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}&&, std::allocator<void> const&) const ()
#11 0x0000000000dbbf03 in boost::asio::detail::work_dispatcher<libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}>::operator()() ()
#12 0x0000000000dbbe4e in void boost::asio::asio_handler_invoke<boost::asio::detail::work_dispatcher<libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}> >(boost::asio::detail::work_dispatcher<lib
torrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}>&, ...) ()
#13 0x0000000000dbbd44 in void boost_asio_handler_invoke_helpers::invoke<boost::asio::detail::work_dispatcher<libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}>, libtorrent::mmap_disk_io::add_co
mpleted_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}>(boost::asio::detail::work_dispatcher<libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent:
:aux::mmap_disk_job>&)::{lambda()#1}>&, libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}&) ()
#14 0x0000000000dbbb88 in boost::asio::detail::executor_op<boost::asio::detail::work_dispatcher<libtorrent::mmap_disk_io::add_completed_jobs_impl(libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>, libtorrent::tailqueue<libtorrent::aux::mmap_disk_job>&)::{lambda()#1}>, std::allocator<void>, boost::asio::detail::scheduler_operation>::do_complete(void*, std::allocator<void>*, boost::system::error_code const&, unsigned long) ()
#15 0x0000000000971828 in boost::asio::detail::scheduler_operation::complete(void*, boost::system::error_code const&, unsigned long) ()
#16 0x0000000000972f4b in boost::asio::detail::scheduler::do_run_one(boost::asio::detail::conditionally_enabled_mutex::scoped_lock&, boost::asio::detail::scheduler_thread_info&, boost::system::error_code const&) ()
#17 0x0000000000972c08 in boost::asio::detail::scheduler::run(boost::system::error_code&) ()
#18 0x00000000009731f5 in boost::asio::io_context::run() ()
#19 0x000000000096e292 in libtorrent::session::start(libtorrent::flags::bitfield_flag<unsigned char, libtorrent::session_flags_tag, void>, libtorrent::session_params&&, boost::asio::io_context*)::{lambda()#1}::operator()() const ()
#20 0x0000000000971057 in void std::__invoke_impl<void, libtorrent::session::start(libtorrent::flags::bitfield_flag<unsigned char, libtorrent::session_flags_tag, void>, libtorrent::session_params&&, boost::asio::io_context*)::{lambda()#1}>(std::__invoke_other, libtorrent::session::start(libtorrent::flags::bitfield_flag<unsigned char, libtorrent::session_flags_tag, void>, libtorrent::session_params&&, boost::asio::io_context*)::{lambda()#1}&&) ()
#21 0x0000000000970de3 in std::__invoke_result<libtorrent::session::start(libtorrent::flags::bitfield_flag<unsigned char, libtorrent::session_flags_tag, void>, libtorrent::session_params&&, boost::asio::io_context*)::{lambda()#1}>::type std::__invoke<libtorrent::session::start(libtorrent::flags::bitfield_flag<unsigned char, libtorrent::session_flags_tag, void>, libtorrent::session_params&&, boost::asio::io_context*)::{lambda()#1}>(std::__invoke_result&&, (libtorrent::session::start(libtorrent::flags::bitfield_flag<unsigned char, libtorrent::session_flags_tag, void>, libtorrent::session_params&&, boost::asio::io_context*)::{lambda()#1}&&)...) ()
#22 0x000000000097156e in decltype (__invoke((_S_declval<0ul>)())) std::thread::_Invoker<std::tuple<libtorrent::session::start(libtorrent::flags::bitfield_flag<unsigned char, libtorrent::session_flags_tag, void>, libtorrent::session_params&&, boost::asio::io_context*)::{lambda()#1}> >::_M_invoke<0ul>(std::_Index_tuple<0ul>) ()
#23 0x000000000097153f in std::thread::_Invoker<std::tuple<libtorrent::session::start(libtorrent::flags::bitfield_flag<unsigned char, libtorrent::session_flags_tag, void>, libtorrent::session_params&&, boost::asio::io_context*)::{lambda()#1}> >::operator()() ()
#24 0x000000000097151e in std::thread::_State_impl<std::thread::_Invoker<std::tuple<libtorrent::session::start(libtorrent::flags::bitfield_flag<unsigned char, libtorrent::session_flags_tag, void>, libtorrent::session_params&&, boost::asio::io_context*)::{lambda()#1}> > >::_M_run() ()
#25 0x00000000010cca6f in execute_native_thread_routine ()
#26 0x00007f8dd0fd1ea5 in start_thread () from /lib64/libpthread.so.0
#27 0x00007f8dd07f4b0d in clone () from /lib64/libc.so.6

it seems be trapped in the while loop of find_prev

template <typename SizeType>
void * simple_segregated_storage<SizeType>::find_prev(void * const ptr)
{ 
  // Handle border case.
  if (first == 0 || std::greater<void *>()(first, ptr))
    return 0;

  void * iter = first;
  while (true)
  {
    // if we're about to hit the end, or if we've found where "ptr" goes.
    if (nextof(iter) == 0 || std::greater<void *>()(nextof(iter), ptr))
      return iter;

    iter = nextof(iter);
  }
}

seems the mmap_disk_job passed to destroy() never meet the quit conditions in find_prev

[Lwxiang]

I try print some log in free_jobs(), I find that is not stuck, the whole thread is doing the ordered_free almost all the time.

[arvidn]

this is a symptom of heap corruption. Does this reproduce consistently for you? Can you try running it under address sanitizer?

[Lwxiang]

maybe it is the same heap corruption with https://github.com/arvidn/libtorrent/issues/7386

can the address sanitizer result in that issue help?

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.